overlord/fdestate/activate_state.go: give inactive state on classic

Author: valentindavid

daemon/api_general.go

@@ -572,7 +572,14 @@ func sysInfoStorageEnc(c *Command, r *http.Request, user *auth.UserState) Respon
 	st.Lock()
 	defer st.Unlock()
 
-	state, err := fdestateSystemState(st)
+	devmgr := c.d.overlord.DeviceManager()
+
+	model, err := devmgr.Model()
+	if err != nil && !errors.Is(err, state.ErrNoState) {
+		return InternalError("cannot find model: %v", err)
+	}
+
+	state, err := fdestateSystemState(st, model)
 	if err != nil {
 		return InternalError("cannot determine system encrypted state: %s", err)
 	}

daemon/api_general_test.go

@@ -33,16 +33,20 @@ import (
 	"gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/arch"
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/daemon"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/dirs/dirstest"
 	"github.com/snapcore/snapd/features"
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/ifacetest"
+	"github.com/snapcore/snapd/overlord/assertstate/assertstatetest"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/configstate/config"
+	"github.com/snapcore/snapd/overlord/devicestate"
 	"github.com/snapcore/snapd/overlord/fdestate"
+	"github.com/snapcore/snapd/overlord/hookstate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/sandbox"
@@ -1232,10 +1236,84 @@ func (s *generalSuite) TestAckWarnings(c *check.C) {
 	c.Check(result, check.DeepEquals, 0)
 }
 
-func (s *generalSuite) TestSysInfoStorageEncHappy(c *check.C) {
+func (s *generalSuite) TestSysInfoStorageEncHappyWithoutModel(c *check.C) {
 	s.daemon(c)
+
+	expectedStatus := ""
+	expectedResponse := map[string]any{}
+
+	setExpectedStatus := func(status string) {
+		expectedStatus = status
+		expectedResponse["status"] = status
+		expectedResponse["auto-repair-result"] = "not-initialized"
+	}
+
+	defer daemon.MockFdestateSystemState(func(s *state.State, model *asserts.Model) (*fdestate.FDESystemState, error) {
+		switch expectedStatus {
+		case "active":
+			return &fdestate.FDESystemState{
+				Status:           fdestate.FDEStatusActive,
+				AutoRepairResult: fdestate.AutoRepairNotInitialized,
+			}, nil
+
+		case "inactive":
+			return &fdestate.FDESystemState{
+				Status:           fdestate.FDEStatusInactive,
+				AutoRepairResult: fdestate.AutoRepairNotInitialized,
+			}, nil
+		}
+
+		c.Check(model, check.IsNil)
+
+		return nil, errors.New("cannot set unsupported expected status")
+	})()
+
+	req, err := http.NewRequest("GET", "/v2/system-info/storage-encrypted", nil)
+	c.Assert(err, check.IsNil)
+
+	setExpectedStatus("active")
+	rsp := s.syncReq(c, req, nil, actionIsExpected)
+	c.Check(rsp.Status, check.Equals, 200)
+	c.Check(rsp.Type, check.Equals, daemon.ResponseTypeSync)
+	resultBytes, err := json.Marshal(rsp.Result)
+	c.Assert(err, check.IsNil)
+	var resultAbstract any
+	err = json.Unmarshal(resultBytes, &resultAbstract)
+	c.Assert(err, check.IsNil)
+	c.Check(resultAbstract, check.DeepEquals, expectedResponse)
+
+	setExpectedStatus("inactive")
+	rsp = s.syncReq(c, req, nil, actionIsExpected)
+	c.Assert(err, check.IsNil)
+	resultBytes, err = json.Marshal(rsp.Result)
+	c.Assert(err, check.IsNil)
+	err = json.Unmarshal(resultBytes, &resultAbstract)
+	c.Assert(err, check.IsNil)
+	c.Check(resultAbstract, check.DeepEquals, expectedResponse)
+}
+
+func (s *generalSuite) TestSysInfoStorageEncHappyWithModel(c *check.C) {
+	d := s.daemonWithOverlordMockAndStore()
 	s.expectSystemInfoStorageEncReadAccess()
 
+	hookMgr, err := hookstate.Manager(d.Overlord().State(), d.Overlord().TaskRunner())
+	c.Assert(err, check.IsNil)
+	deviceMgr, err := devicestate.Manager(d.Overlord().State(), hookMgr, d.Overlord().TaskRunner(), nil)
+	c.Assert(err, check.IsNil)
+	d.Overlord().AddManager(deviceMgr)
+	func() {
+		st := d.Overlord().State()
+		st.Lock()
+		defer st.Unlock()
+		assertstatetest.AddMany(st, s.StoreSigning.StoreAccountKey(""))
+		assertstatetest.AddMany(st, s.Brands.AccountsAndKeys("my-brand")...)
+		s.mockModel(st, s.Brands.Model("my-brand", "my-model", map[string]any{
+			"architecture": "amd64",
+			"gadget":       "gadget",
+			"kernel":       "kernel",
+		}))
+	}()
+
 	expectedStatus := ""
 	expectedResponse := map[string]any{}
 
@@ -1245,7 +1323,7 @@ func (s *generalSuite) TestSysInfoStorageEncHappy(c *check.C) {
 		expectedResponse["auto-repair-result"] = "not-initialized"
 	}
 
-	defer daemon.MockFdestateSystemState(func(*state.State) (*fdestate.FDESystemState, error) {
+	defer daemon.MockFdestateSystemState(func(s *state.State, model *asserts.Model) (*fdestate.FDESystemState, error) {
 		switch expectedStatus {
 		case "active":
 			return &fdestate.FDESystemState{
@@ -1260,6 +1338,8 @@ func (s *generalSuite) TestSysInfoStorageEncHappy(c *check.C) {
 			}, nil
 		}
 
+		c.Check(model, check.NotNil)
+
 		return nil, errors.New("cannot set unsupported expected status")
 	})()
 
@@ -1290,7 +1370,7 @@ func (s *generalSuite) TestSysInfoStorageEncHappy(c *check.C) {
 func (s *generalSuite) TestSysInfoStorageEncErrorImpl(c *check.C) {
 	s.daemon(c)
 
-	defer daemon.MockFdestateSystemState(func(*state.State) (*fdestate.FDESystemState, error) {
+	defer daemon.MockFdestateSystemState(func(*state.State, *asserts.Model) (*fdestate.FDESystemState, error) {
 		return nil, errors.New("cannot calculate status")
 	})()
 

daemon/export_api_general_test.go

@@ -22,6 +22,7 @@ package daemon
 import (
 	"time"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/overlord/fdestate"
 	"github.com/snapcore/snapd/overlord/state"
 	"github.com/snapcore/snapd/testutil"
@@ -71,7 +72,7 @@ func MockSnapdtoolsIsReexecd(f func() (bool, error)) (restore func()) {
 	return testutil.Mock(&snapdtoolIsReexecd, f)
 }
 
-func MockFdestateSystemState(f func(*state.State) (*fdestate.FDESystemState, error)) (restore func()) {
+func MockFdestateSystemState(f func(*state.State, *asserts.Model) (*fdestate.FDESystemState, error)) (restore func()) {
 	old := fdestateSystemState
 	fdestateSystemState = f
 	return func() { fdestateSystemState = old }

overlord/fdestate/activate_state.go

@@ -22,6 +22,7 @@ import (
 	"errors"
 	"os"
 
+	"github.com/snapcore/snapd/asserts"
 	"github.com/snapcore/snapd/boot"
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/overlord/state"
@@ -99,7 +100,7 @@ type FDESystemState struct {
 
 // SystemState returns a json serializable FDE state of the booted
 // system.
-func SystemState(st *state.State) (*FDESystemState, error) {
+func SystemState(st *state.State, model *asserts.Model) (*FDESystemState, error) {
 	ret := &FDESystemState{}
 
 	repairResult, err := getRepairAttemptResult(st)
@@ -126,10 +127,19 @@ func SystemState(st *state.State) (*FDESystemState, error) {
 		// unlocked.json does not exist, we are in either case:
 		//  * classic with kernel from deb.
 		//  * hybrid/core where snap-bootstrap is too old.
-		ret.Status = FDEStatusIndeterminate
-		// New classic version will still not support this,
-		// so we should be a bit more quiet.
-		logger.Debugf("while reading activate state: %v", err)
+		if model == nil {
+			// If the model is not yet available, they will have to request it again
+			logger.Debugf("activate state was not found, and the model is not set yet; the state will remain indeterminate until the model is set")
+			ret.Status = FDEStatusIndeterminate
+		} else if model.Classic() && !model.HybridClassic() {
+			// This expected that no activate state file
+			// is found. And we know in that case we never
+			// use platform-protected (i.e. TPM backed) encryption.
+			ret.Status = FDEStatusInactive
+		} else {
+			logger.Noticef("WARNING: activate state not found")
+			ret.Status = FDEStatusIndeterminate
+		}
 		return ret, nil
 	} else if err != nil {
 		// Unexpected errors should fail explicitly.